SAP Security Patch Day — October 2025

Exploited 0

Confirmed exploited (CISA KEV, ENISA). "Zero-day" means exploitation was known by the patch day — install these first.

None of this release's vulnerabilities is known to be exploited so far.

Critical 2

• Critical 9.8
  CVE-2025-42937 Directory Traversal vulnerability in SAP Print Service
• Critical 9.0
  CVE-2025-42910 Unrestricted File Upload Vulnerability in SAP Supplier Relationship Management

All vulnerabilities 9